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                       WEDNESDAY, APRIL 23, 2008

                                       U.S. Senate,
                                Committee on the Judiciary,
                                                     Washington, DC
    The Committee met, pursuant to notice, at 10:04 a.m., in 
room SD-226, Dirksen Senate Office Building, Hon. Patrick J. 
Leahy, Chairman of the Committee, presiding.
    Present: Senators Feingold, Cardin, Whitehouse, Specter, 
Kyl, and Sessions.

OPENING STATEMENT OF HON. PATRICK J. LEAHY, A U.S. SENATOR FROM 
                      THE STATE OF VERMONT

    Chairman Leahy. Good morning.
    When Congress last reauthorized and expanded the USA 
PATRIOT Act in March, 2006, I voted against it, although I 
voted for the first one. I stated then that I felt the 
administration and the Congress had missed an opportunity to 
get it right. But we were able to include some sunshine 
provisions, which has given us insight that we will use today 
in our examination of national security letters, or NSLs.
    I have long been concerned by the scope of the authority 
for NSLs and the lack of accountability for their use. 
Thankfully, we are able to include requirements for review of 
the NSL program by the Inspector General when we reauthorized 
the PATRIOT Act. There had not been that kind of a review 
before.
    Now, for 2 years, the reports by the Inspector General have 
revealed extremely troubling and widespread misuse of NSLs. The 
authority to issue NSLs allows the Federal Bureau of 
Investigation to request sensitive personal information: phone 
bills, e-mail transactions, bank records, credit reports, 
things that could basically stop a business while they try to 
put this all together, and do this without a judge, without a 
grand jury, without even having a prosecutor evaluate those 
requests.
    In the reports, the Inspector General has found some very, 
very disturbing misuse of this authority. The Inspector 
General's report found widespread violations, including failure 
to comply with even the minimal authorization requirements, and 
more disturbingly, that the FBI requested and received 
information to which it was not entitled under the law. The 
reports found some rampant confusion about the authorities, and 
virtually no checks to ensure compliance or correct mistakes.
    But what I found very significant, is the Inspector General 
found that NSL use has grown to nearly 50,000 a year, and 
nearly 60 percent of those NSLs are used to find information 
about Americans. It is a major change in the years since 9/11. 
I raised these concerns publicly and privately with Director 
Mueller of the FBI. In fairness, the FBI has acknowledged some 
problems. It has issued new guidelines, new guidance, a new 
data system to track issuance of these NSLs.
    It has also created an Office of Integrity and Compliance 
to ensure that there are processes and procedures in place to 
ensure compliance.
    I believe that the Director and his staff are sincere in 
their efforts, but I am not persuaded that the actions taken 
have been enough. So we are following up on an earlier 
oversight hearing to ask what changes are needed to the 
statutory authority. Among the things that concern me are 
whether the law should require higher level review and 
approval, perhaps judicial or Department of Justice review, 
before NSLs can be issued.
    Is a standard for issuance which requires only that it be 
relevant to a terrorism investigation too lenient? I mention 
this, because we have seen all the statistics, the sudden huge 
increase in the number of arrests that were related and said to 
be terrorism. Then when we asked the question about, if they 
are terrorists, why did they get a fine or 30 days in jail or 
60 days in jail? Well, it turned out they were just run-of-the-
mill cases that they reclassified so that the statistics were 
good. I want to know if that is the same thing here. Is the 
scope of documents available under NSLs too broad?
    I'd like to hear how we can ensure that there are adequate 
standards for determining when private records on U.S. persons 
that have been collected using NSLs, how can they be retained? 
Actually, how can they be disseminated and used?
    Simply because one of these NSLs is issued with no 
guidance, no checks and balances, or anything else and their 
name gets picked up, are they going to find some day when their 
kids are trying to get into college, are they blocked? If 
they're trying to get a job or a promotion, are they suddenly 
blocked and they don't know why?
    Now, I commend Senator Feingold. He's been a leader on this 
issue. I believe his bipartisan bill, the National Security 
Letter Reform Act of 2007, is on the right track, particularly 
in its recommendation for the need for a real check on 
independent oversight of NSLs.
    The bill would also narrow the extraordinarily broad scope 
of information that NSLs can acquire. They would make the 
standard for their issuance more rigorous. I look forward to 
hearing our witnesses' view on this important legislation, 
getting ideas from them if there are other important steps we 
can take.
    The problem we see with NSLs is just one part of a much 
broader concern. We all know that the changing nature of 
national security threats, and particularly the threat from 
international terrorism, has required changes in the way the 
government collects and uses intelligence, the kind of 
information it needs. Nobody disagrees with that.
    But we have to remember what a perilous undertaking it is 
when the government engages in domestic spying. Americans don't 
like it, and for very good reason. We have a long history of 
abuses: the Red scare of 1919; McCarthyism; co-intel for 
Watergate; the recent Pentagon Talon data base program; the 
collected information on Quakers and other anti-war protestors.
    Can you imagine the shock that must have been, those 
collecting that, to find that Quakers were protesting a war? 
Quakers always protest a war. The shock would have been if, 
when they did that, spying on these Quakers, if they had them 
saying, we're in favor of war. Now, that, that would have been 
worth collecting.
    So if we're going to adapt our collection and use of 
information for Americans as a changing threat, we have to be 
sure to do the same for the checks and accountability 
mechanisms, we have to protect our liberties as Americans. The 
FBI's misuse of NSLs is one example of the need for clearly 
defined procedures and careful controls when collecting and 
using domestic intelligence, but we have to be just as vigilant 
in other areas: data mining, use of satellites to collect 
domestic information, biometrics, fusion centers. They are all 
tools for national security, but each is fraught with the 
potential for privacy invasions and harm to American liberties. 
We in the Congress have a responsibility to see how these are 
being used.
    [The prepared statement of Senator Leahy appears as a 
submission for the record.]
    So I am looking forward to this. Senator Specter, who I 
mentioned is the senior Republican on the Committee, has a long 
history of asking these questions of both Republicans and 
Democrats, and I am glad you're here.

STATEMENT OF HON. ARLEN SPECTER, A U.S. SENATOR FROM THE STATE 
                        OF PENNSYLVANIA

    Senator Specter. Thank you, Mr. Chairman. I wouldn't be 
anywhere else, especially since I'm the Ranking Member and I'm 
really not needed here because there's such a large showing of 
Republican members of this Committee to handle this important 
issue.
    This is a prized Committee, very keenly sought after by 
members of the U.S. Senate. If any were here, I would exhort 
them to attend because this is a very important matter, 
especially in the context of what has happened with expansion 
of executive authority.
    Decades from now, I believe historians will look down on 
this period since 9/11 to the present time and beyond as an 
extraordinary expansion of executive power, necessary, at least 
to some extent, as I have stated by my votes and my positions 
in supporting the expansion of the PATRIOT Act.
    But I am concerned when we are having hearings on national 
security letters and we do so in the context of the President 
having issued a signing statement which purports to limit the 
executive's responsibility to comply with Section 119, 
notwithstanding the fact that this was a matter negotiated. 
That's my recollection, confirmed by Nick Rossi, who was on my 
staff at the time and is now Chief Counsel.
    We negotiated the oversight on review of national security 
letters, and then the President signs a statement in which he 
says that he'll interpret Section 119 in a manner consistent 
with the broader Article 2 powers. Well, that's not adequate. 
There's been expressed negotiations. This comes in the context 
where one of the reported incidents involves a matter where the 
FBI sought records under Section 215 under the order for 
business records from the FISA court, twice refused. Then the 
FBI goes to a national security letter based on the same 
information. Well, that sounds wrong to me. If they don't have 
a basis for it when it goes to a court, to come back to 
something they have unilateral control on, it's not exactly 
what Congress intends here. And all of this occurs in a context 
with vast, vast expansion.
    When you have the President violating the Foreign 
Intelligence Surveillance Act, the National Security Act, 
requiring reports to the Intelligence Committees, on his 
purported authority under Article 2, never tested judicially, 
but violations occur on unilateral action. You have the 
concerns about the State Secrets Act, and the Attorney General 
says there will be a calamitous result, violating the 
President's Article 2 powers.
    You have an effort to legislate under the Shield Law and 
letters from the FBI and the Attorney General and the Director 
of National Intelligence and Homeland Security that the world 
is going to collapse, notwithstanding the careful calculation 
of that statute to preserve national security interests.
    The attorney/client privilege, pressed by this 
administration far beyond any other administration. Former 
Attorney General Edwin Meece and former Attorney General 
Richard Thornburg testified in this room that the current 
interpretation is inappropriate. Two principles: the government 
proves its case, and the constitutional right to counsel, which 
necessarily implies confidential privilege. But now there is an 
expansion of executive authority. Thank God for the courts, 
because it has been more than frustrating to be on this 
Committee and to chair it, to be Ranking Member, and not to 
have the semblance of effective oversight. We simply can't 
chase the executive sufficiently to have effective oversight.
    Now there is a move to have retroactive immunity to the 
telephone companies. As yet on the record we don't know what 
that retroactive immunity is for, but we're asked to grant it 
legislatively. I believe that from what I know as to what the 
telephone companies have done, they've been good citizens and 
they ought to be protected. But the government can step into 
their shoes and defend those cases and preserve the open 
courts, and also to give the telephone companies their due.
    So I would say, Mr. Chairman, we ought to do a lot more, 
but I'm not quite sure what to do.
    Chairman Leahy. Well, if the Senator would yield, I was 
somewhat concerned when I became Chairman. I'd send letters 
down to Department of Justice asking questions and not get any 
response, and wondered if it was because I was a Democrat and 
it was a Republican administration. Then I found out that the 
chairman, when he was chairman, found it difficult to get 
answers to those letters also.
    Senator Specter. Well, I'm still co-signing the letters, 
Mr. Chairman.
    Chairman Leahy. I know you are, and I appreciate that very 
much. I think oversight--I agree with the Senator from 
Pennsylvania. Oversight is extremely important because if you 
have no check and balance, at a time when our government can be 
all-powerful, it is a terrible situation. The Senator from 
Pennsylvania, like myself, was a prosecutor. There are a lot of 
things we would have loved to have done unilaterally. But 
fortunately we couldn't. We had to have oversight by the 
courts, we had to have checks and balances. The country's safer 
that way.
    Senator Specter. I want to associate myself with the 
remarks which you made, following the interruption, and 
conclude my statement just by associating myself.
    Chairman Leahy. I apologize. I thought you had. I thought 
you had.
    Senator Specter. Oh, no you don't. It's fine. We do it all 
the time and it's totally acceptable.
    Chairman Leahy. You see? What you all missed was the 
opportunity to see Senator Specter and myself at a hearing in 
Vermont.
    Senator Specter. Where was everybody?
    Chairman Leahy. It was very interesting. They're still 
talking about it up there, approvingly.
    Senator Specter. It was an official Committee hearing. 
Where was everybody?
    Chairman Leahy. And Senator Specter was praised by 
Republicans and Democrats across the political spectrum for his 
participation.
    Senator Feingold, this is your legislation. If you want to 
say something, please feel free.

STATEMENT OF HON. RUSSELL D. FEINGOLD, A U.S. SENATOR FROM THE 
                       STATE OF WISCONSIN

    Senator Feingold. Thank you, Mr. Chairman and Ranking 
Member Specter. Thank you for holding this important hearing, 
and for your commitment to this issue.
    I could not agree more that greater oversight and 
accountability are needed with respect to national security 
letters. The Justice Department's Inspector General documented 
serious misuse and abuse of national security letters from 2003 
to 2006.
    A followup audit conducted by the FBI itself not only 
confirmed the Inspector General's findings, it documented even 
more violations. These widespread problems are directly 
attributable to the PATRIOT Act, which expanded the NSL 
statutes to essentially grant the FBI a blank check to obtain 
sensitive information about innocent Americans.
    Congress gave the FBI very few rules to follow and then 
failed to adequately fix these problems when it reauthorized 
the PATRIOT Act. I appreciate that Director Mueller and others 
in the FBI leadership ranks have taken these problems 
seriously, but leaving this to the FBI alone to fix is not the 
answer. These Inspector General reports prove that ``trust us'' 
simply doesn't cut it.
    It was a significant mistake for Congress to grant the 
government broad powers and just keep its fingers crossed that 
they wouldn't be misused. Congress has the responsibility to 
put appropriate limits on government powers, limits that allow 
agents to actively pursue criminals, terrorists, and spies, but 
that also protect the privacy of innocent Americans.
    Congress must also ensure that the statute complies with 
the Constitution. In that vein, last fall a Federal District 
Court struck down one of the new NSL statutes, as modified by 
the PATRIOT Act Reauthorization legislation enacted in 2006 on 
First Amendment grounds.
    This is why I introduced the National Security Letter 
Reform Act with a bipartisan group of Senators, including 
Senators Sununu, Durbin, Murkowski, Salazar, Hagel, and others. 
This bill places new safeguards on the use of national security 
letters and related PATRIOT Act authorities to protect against 
abuse and ensure the constitutionality of the statute.
    Among other things, it restricts the type of records that 
can be obtained without a court order to those that are the 
least sensitive and private, and it ensures that the FBI can 
only use NSLs to obtain information about individuals that have 
at least some nexus to a suspected terrorist or spy. I am 
pleased that it has received endorsements from all over the 
political spectrum, from the Center for American Progress, to 
the League of Women Voters, to Grover Norquist of Americans For 
Tax Reform.
    I would ask, Mr. Chairman, that an April 22 letter in 
support of the bill, as well as a ``Dear Colleague'' about the 
bill, be included in the record.
    Chairman Leahy. Without objection, so ordered.
    [The prepared statement of Senator Feingold, with 
attachments, appears as a submission for the record.]
    Senator Feingold. Thank you, Mr. Chairman.
    This legislation is a measured, reasonable response to a 
serious problem. Again, thank you very much for holding the 
hearing on the bill and on this topic, and I look forward to 
the witnesses' testimony.
    Chairman Leahy. Thank you.
    Senator Cardin, did you wish to--

 STATEMENT OF HON. BENJAMIN L. CARDIN, A U.S. SENATOR FROM THE 
                       STATE OF MARYLAND

    Senator Cardin. Thank you, Mr. Chairman. Just very briefly, 
let me first comment that I will be moving between this 
Committee and the Foreign Relations Committee that has a 
hearing on Darfur today. I'm saying that for Senator Specter's 
benefit, because I'm sure his colleagues are very busy in other 
committees that are holding hearings today.
    But obviously this is an extremely important hearing, and I 
thank you very much for conducting this hearing.
    I just want to make a quick observation, if I might. I 
think Americans would be very surprised to learn that there are 
tens of thousands of national security letters issued every 
year--every year--the majority of which are directed toward 
Americans, requesting sensitive information such as their 
credit information or their telephone records, and it is done 
without any court supervision. They also, I think, would be 
surprised to learn about the Inspector General's report that 
pointed out that a large number of these letters were issued 
contrary to the law, in violation of the authority that the 
Department had.
    So I think it's very important for us to do the appropriate 
oversight. I'm sure we're going to hear today, Mr. Chairman, 
that as a result of the Inspector General's report, as a result 
of the oversight that this Committee has done, that the 
circumstances are improved, that procedures are now in place, 
that the number of violations of laws have been reduced 
dramatically and that the circumstances and the use of national 
security letters have improved dramatically.
    But what happens when we turn off the spotlight? What 
happens when Congress does not hold regular oversight hearings 
on the use of national security letter? Will we revert back to 
the use of these letters, contrary to law? When one agency can 
make a decision without review of the courts, without 
oversight, there is the potential for abuse.
    So I just want to compliment Senator Feingold for his 
legislation. I think it's important that we look at ways in 
which we can establish the appropriate check-and-balance in our 
system to make sure that the agencies have the tools that they 
need to protect our country and to pursue investigations that 
are important so they can get the material necessary for 
investigations, but at the same time protect the civil 
liberties of the people of our Nation. Clearly that was not 
done over the last five or 6 years. Clearly that was abused and 
did not further justice, and it did hurt the civil liberties of 
the people of our country.
    So I think that we should not only be holding the oversight 
hearing that Senator Specter has talked about the importance 
of, but to look at ways in which we can institutionalize a 
better check-and-balance system on the use of this 
extraordinary power by the Department of Justice.
    Mr. Chairman, I look forward to our witnesses. Again, I 
apologize if I have to leave to attend another hearing on the 
circumstances within the Darfur region of Sudan.
    Chairman Leahy. Thank you very much.
    Senator Whitehouse, did you have anything you wanted to 
add?

 STATEMENT OF HON. SHELDON WHITEHOUSE, A U.S. SENATOR FROM THE 
                     STATE OF RHODE ISLAND

    Senator Whitehouse. Thank you, Mr. Chairman.
    Very briefly, I just wanted to commend Senator Feingold for 
his legislation. He has undertaken what those of us who have 
the honor of working with him have come to expect as a very 
thoughtful and thorough approach to this issue. I think we 
should also take a moment, if it has not been done already, to 
commend Inspector General Glen Fine. We are here, in large 
part, because of the research work that he did.
    Our job is to oversee the executive branch and remark and 
bring attention to situations where folks have failed in their 
duties or failed in their responsibilities, and assure that 
those mistakes are cured. It is also, I think, our 
responsibility to express appreciation and pride when folks in 
the executive branch do their duties particularly well.
    I think the Department of Justice Office of Inspector 
General did its duties particularly well in this respect, and I 
think the record of the hearing should reflect that. I remain a 
little bit dismayed that the FBI, as an institution--I had this 
discussion with Director Mueller when he was here--did not more 
highly value the rather extraordinary powers that they were 
given in this legislation and the responsibilities, the 
concomitant responsibilities that came with that.
    The fact that there wasn't adequate internal oversight, 
that there weren't checks and balances going, frankly, right up 
to the Director's office, because this is an issue that 
directly affects the credibility of one of our proudest law 
enforcement agencies with this Congress, and if they're not 
minding the store when we give them the kind of scope--I think 
mistakenly, but irrespective of that--that they are and it's 
cabined with particular congressional restrictions, the level 
of disinterest in attending to those congressional limitations 
is kind of surprising.
    You would have thought that the highest levels of the FBI, 
somebody would be saying, you know, this is pretty serious 
stuff, they put some pretty serious boundaries around it. We're 
going to look like real dopes if we foul this up. You know, 
somebody in my office is going to be in charge of making sure 
this is done right. The failure of that, I think, is an 
interesting and significant failure in this whole process.
    So I very much look forward to the testimony of all the 
witnesses. I appreciate the Chairman holding this hearing, and 
I thank Senator Feingold for, once again, his thoughtful and 
thorough approach to an important issue.
    Chairman Leahy. Well, thank you very much.
    Gentlemen, you've had a chance to hear our views on this. 
Don't let that influence you in any way, shape, or manner as 
you give your testimony. I mean that, seriously.
    The first witness will be James Baker. He has an extensive 
background in the area of national security. He served at the 
Justice Department for 17 years. He was Counsel for 
Intelligence Policy in the Office of Intelligence Policy & 
Review from 2001 to 2007. Is that correct? A former Federal 
prosecutor, he's worked on a wide variety of national security 
matters. He taught national security law at Harvard Law School 
in 2007. He's a Fellow at the Institute of Politics at 
Harvard's Kennedy School of Government. He currently serves as 
the Assistant General Counsel for National Security at Verizon.
    He received his bachelor's degree from the University of 
Notre Dame and his law degree from the University of Michigan 
Law School.
    Mr. Baker, please go ahead, sir.

 STATEMENT OF JAMES A. BAKER, FORMER COUNSEL FOR INTELLIGENCE 
        POLICY, DEPARTMENT OF JUSTICE, WASHINGTON, D.C.

    Mr. Baker. Thank you, Mr. Chairman, Ranking Member Specter, 
and members of the Committee. I appreciate the opportunity to 
be here today.
    Let me just say at the outset that I am appearing here 
today in my individual capacity at the request of the Committee 
and anything I say should not be taken as reflecting the views, 
necessarily, of my current or former employers.
    So, Mr. Chairman, you have my written statement, which I 
would ask to be made part of the record.
    Chairman Leahy. Without objection, it will be part of the 
record.
    Mr. Baker. Thank you, sir.
    [The prepared statement of Mr. Baker appears as a 
submission for the record.]
    Mr. Baker. I won't try to recapitulate what I say there, 
but my objective today is to try to be of whatever assistance I 
can to the Committee to try to put national security letters in 
context with what the intelligence community, the FBI, is doing 
every day to conduct national security investigations and to 
obtain foreign intelligence information. So what I am urging 
today is that we think about this in a holistic way and try to 
understand the perspective of the people on the ground who have 
to use these tools as they go about doing what everybody agrees 
we want them to do, which is to protect the country.
    And so what I urge is we not focus just on NSLs, but we 
think in a larger way about the whole question of what I refer 
to as metadata. I'll come back to that. Well, I'll just address 
that right now.
    Metadata, as I describe in my written statement, what I 
mean by that, and what other people have referred to or used 
that term to refer to, is really a distinction between content 
information and non-content information. Content information is 
the words that are spoken on a telephone call, the substance of 
an e-mail, what happens in the privacy of our homes, those 
kinds of things. That's the content that I refer to.
    When I'm talking about metadata I'm talking about non-
content. It's information about those things, maybe the date, 
the time, the duration of the telephone call, the ``to'' and 
``from'' of an e-mail, indications about where you moved at 
different points in time, but it's not your actual substance of 
your communications.
    So what I think, and what I'm trying to say today is that 
Congress, I suggest, should think about the problem or the 
issue of the collection of non-content information and how it 
wants the government to go about doing that, and what rules 
apply, what oversight there should be, and so on.
    Metadata, generally speaking, is not protected by the 
Fourth Amendment. Content is protected by the Fourth Amendment. 
Metadata is protected in some instances by statute, but in many 
instances by nothing. There are no statutes with respect to 
certain types of metadata. So what I think Congress needs to 
think about, is what does it want the government to do? What do 
we as Americans want the government to do with respect to the 
collection of all types of metadata, from the types of metadata 
we're talking about today from national security letters, but 
broadly, all different types of metadata? That's the big issue. 
That's the big privacy issue, I think, that faces us today.
    Let me just say, metadata is a critically important tool 
for conducting national security investigations. It's been 
referred to as the bread and butter of FBI investigations. But 
I don't want to over-sell it, either. It's not a panacea. It 
may be the bread and butter, but it's not necessarily the main 
course or the dessert. I mean, it's not everything. It provides 
you with certain guideposts and ways to think about problems 
and who to focus on, but it's an investigative tool, not an 
investigation.
    My main criticism, I think, of the current statutes that we 
have, and I urge the Congress to think about it as it decides 
what to do next, is that they are just way too complex. There 
are too many tools that are out there for the government to use 
with too many different standards, too many different approval 
levels, too many different oversight mechanisms with respect to 
the collection of metadata.
    For example, as I said in my written statement, there are 
eight different ways, by my count, at least, to get telephone 
toll records. There are eight different ways, with all kinds of 
different standards. That's too complex. That is what leads to, 
I think, some of the confusion that ensues that you see 
reflected in the Inspector General's report, which I also 
commend. I think it's an excellent report.
    So I think as you consider what to do next, you should 
worry about making things too complex. That's what I urge you 
to worry about with respect to that. You should also worry 
about making sure there's adequate oversight. You should make 
sure that there are the right people in the right jobs, working 
hard to get it right. That's critically important. I also urge 
that there be adequate and statutorily mandated minimization 
procedures with respect to all different types of metadata. 
Senator Feingold's bill urges that, or would require that with 
respect to national security letters, but you need to think 
broadly and think about other types of metadata that are 
collected from a variety of different sources.
    As I suggest in my written statement, one thing to think 
about would be a national security subpoena. It would be 
simple, it would be broad in scope. It wouldn't be unlimited in 
scope. It wouldn't be able to collect certain types of data if 
you wanted to restrict that, such as tax records and so on. It 
would not be an administrative subpoena, it would be a subpoena 
that would require the involvement of the Department of 
Justice.
    I see my time has expired, Mr. Chairman, so I will stop 
there. But what I urge is, do not approve a national security 
subpoena unless you also provide for adequate oversight 
mechanisms, provide resources for that, and require 
minimization.
    Thank you, Mr. Chairman.
    Chairman Leahy. Thank you. We will go into what you mean by 
adequate oversight on that.
    The next witness is Gregory Nojeim--did I get that correct?
    Mr. Nojeim. Yes.
    Chairman Leahy. Thank you. He's a Senior Counsel and 
Director of the Project on Freedom, Security & Technology at 
the Center for Democracy & Technology in Washington. He's a 
recognized expert on Fourth Amendment and surveillance issues 
arising in the national security and intelligence areas. Before 
joining CDT in May of 2007, he was the Associate Director and 
Chief Legislative Counsel for the American Civil Liberties 
Union. He received his bachelor's degree from the University of 
Rochester and his law degree from the University of Virginia.
    Go ahead, sir.
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    Mr. Nojeim. Thank you, Senator Leahy, Senator Specter, 
members of the Committee. Thank you for the opportunity to 
testify today on behalf of CDT.
    The DOJ Inspector General found widespread errors and 
violations in the FBI's use of NSLs to obtain bank, credit, and 
communication records of U.S. citizens without prior judicial 
review. These violations are the natural, predictable outcome 
of the PATRIOT Act and other legal and technology changes. They 
weakened the rules under which FBI agents make these demands 
while dramatically expanding their scope. In response, the FBI 
issued detailed guidance on NSLs that contains many useful 
elements.
    But internal reforms can only fix so much. The only way to 
truly address the problems is to legislate traditional checks 
and balances under which a judge must approve governmental 
access to sensitive information.
    So far, NSL legislation has been a one-way street. With 
almost every change in the law, more records from more 
businesses with more personal information about people 
increasingly distant from the target of the investigation have 
been made available to more people in government, with more 
coercion and less judicial oversight. And, the judicial review 
that has been provided for has been largely toothless.
    Self-policing doesn't work. Going to a judge makes a 
difference in a way that is unachievable by merely internal 
reviews or by reviews conducted by attorneys in a different 
part of the executive branch.
    Senator Specter said, ``Thank God for the courts.'' It's 
time to give the courts something meaningful to do in this 
context.
    We ask that you enact legislation that reflects the 
principle that the more sensitive the information sought, the 
tighter the standard should be for getting it and the more 
exacting and detached the review for the request for 
information should be.
    When revealing information is sought in an intelligence 
investigation, mere relevance without judicial review and 
without a tie between the subject of the records and a foreign 
power is an inappropriate standard. The weak relevance standard 
is often justified by drawing parallels between NSLs and 
criminal subpoenas, which are issued without prior judicial 
review.
    But intelligence investigations are more dangerous to 
liberty than criminal investigations. They require stronger 
compensating protections.
    Intelligence investigations are broader than criminal 
investigations. They are not limited by the criminal code. They 
can investigate legal activity, including First Amendment 
activity.
    Intelligence investigations are conducted in much greater 
secrecy than criminal cases, even perpetual secrecy. When a 
person receives a grand jury subpoena, normally a person can 
complain about it. In an intelligence case, when a business 
gets an NSL, they're gagged. They're prohibited by law from 
complaining about it, and the subject of the NSL never learns 
of it.
    Finally, in a criminal investigation almost everything the 
government does is ultimately exposed to scrutiny. The 
prosecutor knows that at the end of the day, his actions will 
often come out in public. That is a powerful constraint. 
There's no public airing at the end of intelligence 
investigations.
    In this context, the relevance standard offers insufficient 
protection against abuse. There is just no substitute for 
tightening the standard and subjecting requests for sensitive 
information to judicial review.
    After-the-fact minimization, while it's important, doesn't 
prevent the initial intrusion. Minimization under FISA, the 
model that many urge for NSLs, is actually quite permissive.
    Moreover, none of the changes that the FBI has put in place 
can get to the core issue. That is to ensure that NSLs are used 
only in a focused way when there is a factual basis for 
believing that the individual whose data is sought is a 
terrorist or a foreign agent, or that information is otherwise 
sufficiently important to the activities under investigation.
    The NSL Reform Act, in contrast, does get to the core 
issue. It creatively honors the principle that sensitive 
information deserves more protection. First, it would separate 
information that can now be obtained with an NSL into sensitive 
and less-sensitive personal information.
    Not all metadata is created alike. Some of it is 
particularly sensitive. The ``to"/"from'' information about a 
person's e-mailing is more sensitive than information that 
merely identifies a person.
    Yesterday I applied for a loan at a bank. The records that 
I gave to the bank might be regarded as metadata under this 
proposal. I had to give them my tax return and a lot of other 
sensitive information that, frankly, I didn't want to give up, 
and frankly shouldn't be available to law enforcement without a 
really good reason.
    We like the way that the NSL Reform Act separates out these 
two types of sensitive information to less sensitive and more 
sensitive, and says that when the information is more sensitive 
there has to be some judicial authorization, usually -probably 
-through Section 215 of the PATRIOT Act before the information 
can be given to the government. These are necessary reforms. 
They and other measures can ensure that the government has the 
tools it needs to prevent terrorism and that those tools are 
subjected to appropriate checks and balances.
    Thank you very much.
    Chairman Leahy. Thank you very much.
    [The prepared statement of Mr. Nojeim appears as a 
submission for the record.]
    Chairman Leahy. Our next witness, Michael Woods, is an 
attorney with extensive expertise in national security areas. 
He served in a variety of national security-related positions 
at the Justice Department, beginning his service in 1993. He 
served as Chief of the FBI's National Security Law Unit from 
1997 to 2002. In private practice, he has advised Department of 
Defense clients in matters of national security policy. He has 
published Law Review articles on national security law issues, 
including those related to national security letters and the 
PATRIOT Act. He graduated from the University of Oxford and 
Harvard Law School.
    Mr. Woods, glad to have you here.
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    Mr. Woods. Thank you, Mr. Chairman.
    Mr. Chairman and members of the Committee, I am very 
pleased to have the opportunity to appear this morning. I 
think, really, I have two things to offer the Committee in this 
very important work. The first, is my practical experience. As 
a former Chief of the FBI's National Security Law Unit, I was 
basically in charge of the national security letter production 
process during the time I was there. I would add and would 
underline that I left the FBI in 2002, and so I am probably not 
the person who can comment on what has gone on more recently 
than that internally, or about the measures that have taken 
place.
    But I can certainly give some insight into how these 
letters were used investigatively prior to the PATRIOT Act, 
into the rationale for the changes that were sought in the 
PATRIOT Act, and into some of the investigative concerns that I 
think persist to this day.
    The second, of course, as the Chairman has noted, I have 
written on what I call transactional data, which Mr. Baker is 
referring to as metadata. I will use whatever term the 
Committee wants. I do not mean to create confusion. I have 
summarized this research in my written testimony, and I have 
appended a Law Review article that I think might be helpful.
    Chairman Leahy. Incidentally, all the written testimony of 
all the witnesses will be put in the record in total.
    Mr. Woods. Thank you, Mr. Chairman.
    Like the other witnesses this morning, and I'm sure 
everyone on the Committee, I see in this constantly evolving 
digital environment an enormous challenge for our government. 
The cloud of transactional information or metadata that each of 
us now creates in our daily lives, though it may not contain 
the direct content of our private communications, reveals a 
steadily more detailed picture of our activities, our personal 
habits, our social networks, our finances. This information 
largely resides in the custody of third parties, in quantities, 
formats, and conditions of which most of us remain unaware.
    The constant expansion in the capacity of digital storage 
systems and in the power of search engine technology make this 
transactional information at once more permanent and more 
easily accessible than ever before. This situation poses a real 
challenge to counterintelligence and counterterrorism 
investigators. On the one hand, it allows a new window into the 
hidden activities of our most sophisticated adversaries. On the 
other, the compromise of privacy by the acquisition of 
transactional data seems much greater now, that the quantity 
and detail of that information has increased.
    I believe it is critically important that the Committee 
leave the FBI with a flexible and effective tool for obtaining 
transactional information. That tool should incorporate 
safeguards that inspire public confidence, but safeguards that 
are proportionate and carefully tailored in response to the 
actual harms.
    Though I disagree based on my experience with the 
suggestion that the legal standard for national security should 
be returned to its pre-PATRIOT Act level, I think many parts of 
the current legislative proposal represent very promising steps 
in the right direction.
    I am very happy to elaborate on these views in response to 
your questions, and look forward to assisting the Committee in 
this important work.
    Again, thank you for inviting me.
    Chairman Leahy. Thank you very much, Mr. Woods.
    [The prepared statement of Mr. Woods appears as a 
submission for the record.]
    Chairman Leahy. Over the last several years, the FBI issued 
virtually no guidance. They had no real checks or oversight on 
the expanded use of national security letters. We have had 
several Inspector General reviews which came about because 
Congress, in its oversight, insist on these reviews. They 
pointed out errors in every single aspect of the national 
security letters: they're drafted incorrectly; they're issued 
without even the minimal administration requirements; their use 
was not monitored; the information collected is often not even 
recorded or tracked.
    So, in other words, these Inspector General reports showed 
that the FBI failed in every respect to police its use of NSLs. 
It was only after these devastating IG reports came out that 
the FBI took steps to control use, and then started issuing 
guidance, creating a data bank, and so forth.
    But even now the FBI resists any process for outside 
review. Even though they had this abysmal record following on 
them, they don't want any outside approval. One article likens 
this to the stereotypical male driver who has circled the same 
block four times, but still stubbornly refuses to ask anyone 
for directions. My wife would like that one.
    Now, haven't we seen enough from these IG reports? Though 
the FBI can't effectively check it's own use of this very 
powerful authority, do we have to wait for more years, and 
documents, and so on or should Congress require approval of the 
NSLs outside of the FBI? Who should be the reviewing authority? 
Should we have judicial review? You have differing views.
    Mr. Baker, let me begin with you, then go to Mr. Nojeim, 
then Mr. Woods.
    Mr. Baker. Thank you, Mr. Chairman. Yes. I mean, I 
subscribe to the notion that it's appropriate to have review of 
metadata collection tools, whatever legal tool Congress ends up 
approving outside of the FBI. I think it's appropriate. I think 
it works well when you think about it in the criminal context 
or the grand jury process where the FBI agents need to go--must 
go--to a Federal prosecutor to obtain approval to issue the 
grand jury subpoena so there's an outside check on what happens 
before the document goes out that results in the collection of 
the information. So, I think that's very appropriate.
    I think that system has worked well with respect to grand 
juries. The difficult thing for the Committee is to try to 
calibrate what it does with respect to what the effect is. So 
the higher you ratchet up the approval levels, if you indeed 
require the FBI to go to a court in addition to a Justice 
Department attorney, it's just going to make it that much more 
difficult and that much more time-consuming to obtain the 
information. It will be something that discourages the FBI from 
actually trying to pursue those.
    Now, some people say that's a good idea, we don't want them 
to do all these NSLs. But the volume, as you can see, of the 
number of NSLs is so huge and the time pressure is so great, 
that we need to have something that's--
    Chairman Leahy. But even now they're not even going to the 
U.S. Attorney.
    Mr. Baker. No, I agree. But with the NSLs, they just do it 
internally. It goes to the SAC, Special Attorney in Charge.
    Chairman Leahy. But you would not support judicial review 
because of the volume?
    Mr. Baker. For much of the information, I think judicial 
review is too much. I concede and think it would be a good idea 
if Congress wanted to carve out a certain set of records--tax 
return records, firearms records, educational records, the sort 
of things that are listed in the current 215--out and say, if 
you're going to have this category of material you have to go 
to the court. But for the transaction, for much of the 
transactional data, again, I agree with Mr. Woods, we need to 
be very careful. It needs to be carefully calibrated. You need 
to think about what categories you want to carve out and make 
sure they're really important.
    Chairman Leahy. Mr. Nojeim?
    Mr. Nojeim. That is exactly what the Feingold bill does. It 
carves out the more sensitive information and says for that tax 
return that was given to the bank so a person can get a loan, 
for e-mail ``to''/``from'' information, you've got to go to a 
court first. It's not good enough for the FBI to check itself.
    Let me just say a word about the checks and balances that 
we're calling for. One doesn't normally think of a person in 
the executive branch charged with being a prosecutor or 
protecting national security as being the person who provides 
the check and the balance. It's the judge who has to provide 
that check and the balance. That's their role in our system. 
It's just not the proper role of prosecutors to be actually 
charged with that. They can certainly help, but a true check 
has to be judicial.
    Chairman Leahy. And Mr. Woods?
    Mr. Woods. I guess I would agree with the idea that there 
needs to be judicial review available, but I would focus 
directly on the calibration. I would draw the analogy to the 
grand jury. The former prosecutors on the Committee know that, 
as a prosecutor, you might issue hundreds of grand jury 
subpoenas. Now, the possibility of judicial review is there, 
but it's the prior approval of the court, and in most instances 
in the Federal system, prior approval of a grand jury is not 
something that is required. I think we have to shift toward 
that analysis.
    Chairman Leahy. Of course, in the grand jury the prosecutor 
eventually is going to have to answer to the court how he 
collected the evidence.
    Mr. Woods. Exactly.
    Chairman Leahy. They're not going to say, OK, on every one 
of these subpoenas you have to have a witness come in, but at 
some point they're going to say, it appears you overreached, or 
you didn't. Is that not correct?
    Mr. Woods. That is correct. But I think that one of the 
things we'll certainly end up discussing here is the very 
fundamental distinction between the collection of intelligence 
and criminal investigations. I mean, Congress and the executive 
branch have struggled with the oversight of these activities 
for a long time because that public accounting is not present 
in the intelligence world.
    Chairman Leahy. Thank you.
    Senator Specter?
    Senator Specter. Thank you, Mr. Chairman.
    Mr. Baker, in my opening statement I referred to a 
situation where the FBI had been twice turned down by the FISA 
court on a request for a Section 215 order for business records 
and they then used a national security letter. I am advised, 
further, that at the time you were head of the Office of 
Intelligence, Policy & Review in the Department of Justice and 
that you advised the FBI that they ought not to use a national 
security letter in that context. Is all of that true?
    Mr. Baker. It is true, Senator, that I was head of the 
Office of Intelligence & Policy Review at that time. Senator, I 
don't recall, sitting here today, giving that advice with 
respect to NSLs.
    Senator Specter. Do you recall the situation where the FBI 
had twice been turned down by the FISA court for a Section 215 
order?
    Mr. Baker. I remember the case in general, Senator. I would 
just comment, just as a point of clarification--and I can talk 
more about how the FISA process works--but it was--
    Senator Specter. Well, I don't have much time. There was 
such a case. Then the FBI did use a national security letter in 
that situation?
    Mr. Baker. With respect to that investigation, yes.
    Senator Specter. Well, that's pretty blatantly wrong, isn't 
it, Mr. Baker?
    Mr. Baker. Well, technically speaking, under the law they 
were authorized to do it. Now, that doesn't mean necessarily 
that it was a good idea to do it with respect to the facts that 
are here in this case.
    Senator Specter. Well, did the court turn it down because 
there was a First Amendment issue?
    Mr. Baker. My understanding is that the court did not 
officially turn it down. There was a back-and-forth between the 
government on a number of--
    Senator Specter. OK. But the court didn't grant it?
    Mr. Baker. I beg your pardon?
    Senator Specter. The court didn't grant it.
    Mr. Baker. I'm sorry. I didn't--
    Senator Specter. The court didn't authorize the order?
    Mr. Baker. No, it did not, sir.
    Senator Specter. OK. Well, with 5 minutes of talk, that's 
enough on this issue. To me it's pretty plain that the FBI is 
circumventing the court, which had it twice before it. It 
wasn't granted. That's the critical aspect.
    Let me move to you, Mr. Nojeim. You call for ``specific and 
articulatable facts'' for NSLs. Others have contended that the 
relevance standard is sufficient. Isn't a standard of 
relevance, which is not even reviewed by an attorney, highly 
subjective and highly questionable just on the say-so of an FBI 
agent?
    Mr. Nojeim. It is. It is. One of the problems with a 
relevance standard--
    Senator Specter. Would it slow down the process to make it 
impractical if your standard of a specific and articulatable 
facts standard were to be required?
    Mr. Nojeim. No, I don't think so. The FBI guidance actually 
requires agents now to articulate the reasons why they believe 
that the information sought is relevant to the investigation.
    Senator Specter. Mr. Woods, what do you think about a 
``specific and articulable facts'' standard for NSLs?
    Mr. Woods. I think it's inappropriate.
    Senator Specter. You think what?
    Mr. Woods. I think it's inappropriate. I believe it's 
inappropriate because it was the standard prior to the PATRIOT 
Act. It did slow the process prior to the PATRIOT Act and it 
did make these tools far less available.
    Senator Specter. Well, was it a good process? Just being 
part of the PATRIOT Act doesn't speak to its value, speak to 
its appropriateness.
    Mr. Woods. As I've outlined in my written testimony, it was 
a process and a standard that worked very well in the 
traditional counterintelligence cases of the FBI in chasing 
spies, in cases where you make fairly common investigative 
links from known agents out to their associates, et cetera.
    It did not work very well in the kind of inchoate threat 
situations that we were encountering in terrorism where you 
don't have a lot of facts about the individual, therefore you 
don't have specific facts about the person to whom you are 
trying to connect. This is where that standard started to break 
down in the 1990's, and it's why the FBI asked for it to be 
changed.
    Senator Specter. Mr. Woods, what do you think of Judge 
Posner's argument, which was made again in March of 2007 in the 
Wall Street Journal that the FBI, really, institutionally, is 
not the best agency to handle this, going again and looking to 
the idea of a United States Mi-5. What do you think of that?
    Mr. Woods. I've never been in favor of that. I disagree 
with Judge Posner on that, and some other things.
    I actually think it is a good--I mean, the critics like 
Judge Posner say that it's the FBI's investigative criminal 
orientation that slows down the intelligence gathering process. 
I think that if you're going to have anyone do domestic 
intelligence collection, and I think someone needs to, it ought 
to be people who are steeped in the criminal process, in the 
constitutional process rather than the kind of people we have 
collecting foreign intelligence, for example, who lack that 
background.
    Senator Specter. Thank you very much.
    Thank you, Mr. Chairman.
    Chairman Leahy. Thank you, Senator Specter.
    Senator Feingold?
    Senator Feingold. Thank you, Mr. Chairman.
    Mr. Baker and Mr. Woods, according to the Inspector 
General's reports the FBI uploads information it obtains 
through NSLs into numerous data bases that are widely 
accessible to tens of thousands of personnel at the FBI and 
other agencies.
    I'd like to ask you both, should all this information be 
retained indefinitely, and what type of limit should the FBI be 
required to impose on the type of information it retains and 
the length of time it is kept?
    Mr. Baker?
    Mr. Baker. Well, as I have said in my written statement, 
Senator Feingold, I think there should be rules. There need to 
be minimization rules. As your bill would require for national 
security letters, I would urge you to require it for all types 
of metadata. It's something that Congress needs to worry about, 
not just with respect to the fruits of the national security 
letters, but with respect to all the types of data from all the 
different tools that the government uses to collect metadata, 
including grand jury subpoenas, pen register trap and trace 
orders, all kinds of things.
    That said, with respect to destruction, I do say in my 
statement that I think, if you're going to allow the government 
to collect a lot of data on the front end, you need to minimize 
the retention and dissemination, and at some point in time it 
needs to be destroyed.
    Senator Feingold. Well, the FBI would probably argue that 
you can never predict when the information might be useful. 
Based on your government experience, how quickly does the 
utility of this type of information as actionable intelligence 
start to decrease? I realize you can't say an absolute answer, 
but what is your sense as a professional in this area?
    Mr. Baker. If you're trying to get actionable intelligence 
which will allow you to actually do something to stop a threat, 
stop a spy, it starts to dwindle relatively quickly. So what I 
suggest in my testimony is a pretty long time period, which is 
5 years, destruction after 5 years.
    You can come up with examples where 10, 15, 20 years would 
reveal something about someone, but it is--I don't know how you 
want to say it, but it's a slope that drops pretty quickly, 
Senator. So I think definitely after 5 years, and at some point 
even before that it drops off quickly.
    Senator Feingold. Thank you, Mr. Baker.
    Your response to this issue, Mr. Woods?
    Mr. Woods. I think, definitely, there needs to be a 
mechanism for governing the retention of this information. The 
national security letter statutes were developed kind of 
quickly. They've been ignored and in a corner for most of their 
life. It's really a mistake that these statutes didn't have 
something like this from the beginning. And I would agree with 
Mr. Baker. I think for a model we would look at other things, 
the retention rules that we put in the Attorney General 
guidelines, the retention rules that are in the DoD guidelines. 
There should be that kind of review to eliminate retention as 
quickly as possible.
    Senator Feingold. Based on those responses, I'd like to ask 
each of the witnesses if you could give a ``yes'' or ``no'' 
answer. Is it safe to assume that all the witnesses support the 
provision of the NSL Reform Act mandating that the FBI issue 
minimization and retention procedures for NSLs?
    Mr. Baker?
    Mr. Baker. Yes, I do. But I would also suggest that you 
should worry about acquisition, minimization at the stage of 
acquisition. Don't get more than you really need for the 
purpose that you're searching for it.
    Senator Feingold. Mr. Nojeim?
    Mr. Nojeim. Yes, I agree.
    Senator Feingold. OK.
    Mr. Woods?
    Mr. Woods. Yes, I agree, too.
    Senator Feingold. And I want to thank the Ranking Member 
for raising the issue of the relevance standard, which I 
consider, of course, to be woefully inadequate to protect the 
privacy of Americans who have done nothing wrong. I believe 
that the specific and articulable facts standard is an 
appropriate standard, but we will certainly work on this 
legislation to make sure that the government can get what it 
needs, but not go too far.
    I do think that the relevance standard is not adequate, and 
as Senator Specter said, the mere fact that it was put in as a 
change in the PATRIOT Act is not to me, a recommendation. It is 
actually a sign that it might not have been looked at closely 
enough, because that's my view of the whole legislation.
    Mr. Nojeim, the most recent Inspector General report 
indicated that the percentage of NSL requests generated in the 
course of investigations of U.S. persons has increased steadily 
in the past several years, from 39 percent in 2003 to 57 
percent in 2006. Is this cause for concern?
    Mr. Nojeim. Yes, it is. I think that you can trace that 
increase to the PATRIOT Act itself, which eliminated the 
requirement that the records pertain to an agent or a foreign 
power. Most Americans don't fit that description.
    Senator Feingold. And also, Mr. Nojeim, the FBI conducted 
its own internal review of 10 percent of all NSLs issued from 
2003 to 2006. According to the most recent Inspector General 
report, the FBI's review found more than 550 instances in which 
the FBI received records it had not requested in response to an 
NSL, yet out of those hundreds of incidents only four times did 
the FBI realize that this violation had occurred. That's less 
than 1 percent. The IG report also stated that at least some of 
this unlawfully obtained information was uploaded into an FBI 
data base that is shared more widely with the intelligence 
community. What does that tell us about the extent to which 
these data bases may contain unlawfully obtained information?
    Mr. Nojeim. It suggests that there could be a big, big 
problem. We won't know what information in the data base was 
lawfully obtained and what information wasn't. It's not tagged, 
so you just won't know.
    Senator Feingold. Thanks to all the witnesses.
    Thank you, Mr. Chairman.
    Senator Whitehouse. Thank you.
    I believe Senator Sessions is next in order.
    Senator Sessions. Well, I think the FBI deserves criticism 
for not managing this program well, not following strictly the 
guidelines and accounting correctly in the beginning. Wouldn't 
you agree, Mr. Woods?
    Mr. Woods. Yes, I would.
    Senator Sessions. And Mr. Mueller came here and promised to 
do better, and the OIG report indicates that they have done 
better and fixed the problem in recent months. Is that correct?
    Mr. Woods. That's the testimony.
    Senator Sessions. I think we heard--we know what happened. 
We saw the Director in here. This oversight Committee, which 
has the responsibility to make sure this program is going 
right, we grilled Mr. Mueller, we made him promise to do 
better, and he's done better.
    Now, let me ask you this, Mr. Woods. Isn't it true that a 
DEA agent investigating an American citizen can issue a 
subpoena for some person's telephone toll records if he thinks 
it's relevant to a drug-dealing operation?
    Mr. Woods. That is absolutely true.
    Senator Sessions. And IRS can get your bank records if they 
think you may be cheating on your income tax.
    Mr. Woods. That's correct. There are actually over 300 
Federal agencies that have administrative subpoena authority 
that is based on the relevance standard.
    Senator Sessions. And Mr. Nojeim, forgive me if I object, 
but I do not believe, and strongly reject the idea that we 
ought to give greater protection to terrorists and spies than 
we give to drug dealers and tax cheats. I just do not believe 
that's accurate, and fundamentally that is what I understood 
you to be saying.
    Mr. Nojeim. What I have said, Senator, is that intelligence 
investigations are different. If you're conducting a criminal 
investigation of a terrorist who may have committed a crime or 
a spy who may have committed espionage, which is a crime, the 
same rules apply. What we're talking about is a different kind 
of investigation, one untethered from a criminal charge or from 
criminal suspicion.
    Senator Sessions. Well, OK. Now, Senator Specter asked the 
question about specific and articulable facts, shouldn't that 
be the standard. Well, Mr. Woods, isn't it true that DEA 
doesn't have to quote articulable facts to get your telephone 
toll records?
    Mr. Woods. That's correct.
    Senator Sessions. Or the bank records.
    Mr. Woods. No. These--
    Senator Sessions. Or your motel records.
    Mr. Woods. All of these transactional records are basically 
available in the other context, criminal, administrative 
subpoenas, on relevance to the investigation, Senator.
    Senator Sessions. So we absolutely ought not to be adding 
greater difficulties for investigators investigating a life-
and-death situation, perhaps, than we do for drug dealers. And 
let's make this clear, Mr. Baker. You're a lawyer, and all of 
this. But the reason is, these are not the individual's 
records. These are records in the possession of a third party. 
They have a diminished right of privacy in those records 
because they're not their records. You can't subpoena an 
individual's home computer. You can't subpoena their personal 
records and obtain those records without a warrant, if they 
object. But you can subpoena records at the Office of Motor 
Vehicles, at the telephone records or bank records, right?
    Mr. Woods. That's correct. The Fourth Amendment protects 
things with respect to which you have an expectation of 
privacy, and the type of things we're talking about today, the 
transactional data, is not protected by the Fourth Amendment.
    Senator Sessions. And every day in America, Mr. Woods, 
every county attorney in America investigating any kind of 
misdemeanor or offense that wants records can issue a subpoena 
based on the standard of relevance to that investigation in 
every State in America that I know of. Would you agree?
    Mr. Woods. Yes, I would.
    Senator Sessions. And since time immemorial, that's been 
the standard that prosecutors have used.
    Mr. Woods. Yes.
    Senator Sessions. And how we're in this deal where we want 
to put more standards, more burdens on people who are trying to 
protect the American people from an attack is beyond my 
comprehension, and I'd object to it.
    Let me ask this, Mr. Woods. Let's say you're investigating 
a person that you think may be connected to--you have some 
indication they may be connected to Al Qaeda and you issue a 
subpoena on the relevance to the investigation and get those 
telephone toll records. You see a lot of other calls to someone 
else and you want to now subpoena that person's records to see 
if they may have--see what connections those phone numbers 
show.
    Now, in this context there may not be anything. It may be a 
perfectly innocent series of phone records you receive. But 
isn't it possible, and isn't it what we pay our investigators 
to do, if lo and behold there's a call to some known Al Qaeda 
number in Iraq or Afghanistan? Isn't that what we're about?
    Mr. Woods. Well, yes. I mean, that's the goal of these 
investigations, along with the goal of eliminating the people 
who are not, which is another function of these types of legal 
authorities.
    Senator Sessions. Well, I don't know if somebody got my 
phone--my time is up. We also need to be sure that the 
information we're obtaining is not the power to listen in on 
these phone calls, but it's just simply the telephone toll 
records that show where that person may have called in the 
past. Is that correct?
    Mr. Woods. That is correct. These national security letters 
do not get content of phone conversations or e-mail content.
    Senator Sessions. And I would point out that we tightened 
these standards when we reauthorized the PATRIOT Act. I didn't 
think they needed to be tightened, but we tightened them, all 
to make sure that spies and terrorists have their full rights--
in fact, more rights than we give the drug dealers in America.
    Senator Whitehouse. Senator Kyl? While I am chairing, I am 
going to be the last person here, I'm very happy to have you go 
ahead, if you would like to. I'd be happy to defer to you at 
this point.
    Senator Kyl. I am going to be here for a while, so please 
go ahead.
    Senator Whitehouse. Thank you.
    This is, I think, a very, very interesting question that we 
have and it's a very interesting hearing. I see it in a 
slightly different context than Senator Sessions does, although 
we share the experience of both having been prosecutors and 
U.S. Attorneys.
    It strikes me that there is a privacy interest that is 
raised that is separate from the privacy interest or value of a 
particular piece of data once you start to multiply and 
aggregate it into an enormous pool of data. It's something we 
don't have much guidance on from the Constitution, because at 
the time the Constitution was written the way an investigation 
worked was, the marshall or the sheriff came to your house, 
seized whatever evidence was necessary, brought it before the 
prosecutor or the magistrate, whoever, and when it was done, 
whether it was a bloody axe, a contract document, or whatever, 
it was either contraband, in which case it was destroyed, or it 
was of no value, in which case it was discarded, or it was 
returned and that was the end of that.
    Then along comes the Xerox machine. Now documents start to 
live on in the files of government agencies. Fortunately--or 
unfortunately--they are paper files. They're very hard to go 
back and search.
    So while they're still there for somebody who remembers, 
you know, in the so and so investigation I think we did this, 
let's go back and see what we found when we searched Joe 
Smith's house, we still have that in that file in this paper 
record, it's not a very live record.
    Now, electronically we can not only preserve it, but we can 
aggregate it and we can maintain it indefinitely, and we can 
build, in theory, a massive consolidated data base of all of 
this information that people could plow through at will.
    I do think, despite the fact that none of those individual 
pieces of data might rise over Fourth Amendment levels, it does 
raise a new question that we as a society need to address. So I 
would ask you to comment a little bit on those thoughts, and in 
particular the sort of nexus or matrix between the intensity of 
the privacy value of a particular piece of data that is sought 
versus the intensity of the investigation itself.
    I am not sure whether I would be more concerned as a 
citizen about my privacy if the government said, look, I want 1 
year's tax records for this one purpose or if they said, every 
phone call you have ever made, we are going to track who you 
made it to, when you made it, when it ended, and we're going to 
share it with all people who are interested.
    The privacy balance, I just think isn't that easy, yet it's 
hard to measure that intensity of government investigation 
component. It's so much easier when the document itself is the 
trigger. How would you recommend--do you have thoughts on how 
you'd recommend we cope with that concern? And I'll followup 
further.
    Mr. Baker. Senator, at the end of my written statement I 
have a statement in there about, as time goes by--you're 
exactly right--and our data collection capabilities increase, 
every human endeavor that can be reduced to a digital form will 
be collected by someone for some purpose, either commercially 
or for intelligence purposes or law enforcement. That's the 
direction we're heading in. These do become extremely powerful 
tools. They're powerful tools to protect the country. They're 
powerful tools that, when you have an urgent situation, you can 
go into a data base, you can search through, you can look for 
connections.
    Senator Whitehouse. And they're valuable tools. They're 
important tools, I think we all agree.
    Mr. Baker. Right. Extremely valuable.
    Senator Whitehouse. But they still need some--
    Mr. Baker. They need oversight. They need oversight and 
they need minimization. They need oversight by people. We can 
have all of our technology, we can have all of our systems, we 
can have all of our laws, quite frankly, but at a certain point 
in time the people matter.
    For example, it mattered that Glen Fine was Inspector 
General at the Department of Justice at the time that you 
ordered a review of these things. I've worked with Glen closely 
and he's a very tenacious, intelligent, hard-working person. It 
mattered who he was. So you really have to make sure you have 
the right people in those jobs, doing the right thing.
    At a certain point--I know time is almost up--you are 
right, I think, to focus on the Fourth Amendment issues. At a 
certain point in time, when the government's knowledge about 
our activities becomes so pervasive, that may, in fact, raise 
Fourth Amendment concerns. I think it's something that we're 
going to be struggling with.
    Senator Whitehouse. Let me interrupt you now, because my 
time has expired and I do have plenty of time with you once 
Senator Kyl has a chance to ask his questions, and yield to the 
distinguished Senator.
    Senator Kyl. Thank you very much. I think we all agree 
that, over time, the challenge presented by the acquisition of 
this transactional information is going to require us to 
develop new regimes or protocols of dealing with it.
    What I'd like to do, especially with regard to how long you 
keep it, I do suspect that the last thing government agencies 
are going to want are roomfuls of data that they can't do 
anything with because they're simply too massive.
    But what I'd like to do here is focus just a little bit on 
how this process actually works, the typical situation, because 
it gets to the standard that we're debating here and the reason 
why we went to a relevance standard.
    This is transactional information about which the 
individuals had no expectation of privacy. Mr. Woods, you had 
experience in actually doing this and actually supervising it. 
Give us an example of how it worked. I'm specifically 
interested in why it's different in the context of preventing a 
crime from being committed, a terrorist act, as opposed to 
investigating a crime that has been committed.
    Mr. Woods. OK. I think that probably the best example is 
the sort of classic terrorist threat scenario that we run into 
a lot these days, where there is information, perhaps from 
foreign intelligence, which indicates maybe a particular target 
or a particular city or a particular--there's been a foreign 
communication that is suspect. We don't know who made the 
communication, but it has enough characteristics that we're 
concerned about it and it says something about Washington, DC.
    This is thrown to the FBI in a proactive mode. What can the 
FBI do? Well, the FBI could say--say it's sort of an e-mail, or 
the FBI might want to look at other e-mails that had connected 
to the same source, maybe it's from an internet cafe or 
something like that, and just do a quick scan to see, is this 
point of communication been in contact with anybody else that 
we know about, anything that might give us a lead? That 
transactional information about those communications is 
certainly relevant to the threat. It would be, I think, 
impossible in those situations to make out a specific and 
articulable facts case.
    We don't know who the person on the other end of the 
communication is. We don't know for sure that they're an agent 
of a foreign power. It becomes very gray and circumstantial. We 
could spend a lot of time trying to work with that standard. 
That's kind of--I mean, that is why we asked, in the Bureau, 
for the relevance standard. There are situations where, you 
know, when the FBI is being mandated to be proactive and to 
depart from the investigative model, it's encountering these 
situations that don't fall into line with the standard that was 
designed for an investigative model. It is more dangerous. It 
is more risky in terms of civil liberties, but it is, in my 
view, what needs to be done now.
    I would focus, therefore, more on the oversight, retention, 
and minimization end of this than on the legal standard itself.
    Senator Kyl. Now, that is the precise thing that I think we 
need to focus on. Why would you do that? Why would you want to 
retain the relevancy standard rather than going back to the 
articulable facts standard that we discussed earlier? Why would 
minimization procedures or other oversight be a better answer 
to the privacy concerns?
    Mr. Woods. Well, I think the standard itself, the scenario 
that I laid out, I think is going to become more and more 
common. We're going to need to assess threats quickly. We're 
going to need to respond to them quickly. But by their very 
nature, many of them are going to fall into the sort of fuzzy 
environment that the relevance standard is far better for. I 
mean, there's a reason why it's the standard for criminal 
investigations. This is how you quickly figure out what's going 
on.
    I do think, though, where the system is breaking down is, 
once that's done, once that information is collected, how long 
do we keep it? What impulse is there for the government to sort 
through that? If I might, just one sort of side issue on this. 
The government--the FBI and other agencies--are facing two 
pressures. I mean, one is, get out there in front of the 
threats.
    The other pressure is, share information. These data bases 
didn't exist when I was first in the FBI. They exist now 
because of our examination of the failure of information 
sharing prior to 9/11. So I think with those two things 
together, you need to reinvigorate the rules on minimization 
and retention. They were never added to national security 
letter statutes in the first place. All these things came into 
existence without those, very unlike, say, FISA or criminal 
statutes in that regard. But that is why I would focus the 
attention there.
    Senator Whitehouse. Senator, can I just followup on that? 
Since it's down to just the two of us, we can be off the clock.
    Senator Kyl. Sure. That's fine. Go on, please. Senator 
Feingold might object to that now, but it's fine with me.
    Senator Whitehouse. Continue as long as you please, though.
    Senator Kyl. No. Let's just go ahead and have others 
respond to that if they like, and then a final comment. That 
will be fine.
    Mr. Nojeim. Mr. Woods has made a good case for the 
relevance standard, but the problem that we see with it is that 
it really doesn't have a good articulable end.
    Say, for example, the threat information that is received 
is that there's a terrorist in Washington, DC. What information 
is relevant to investigating that threat? Is information about 
everyone who is staying at a hotel in Washington relevant? Is 
information about everyone who rented a car in Washington 
relevant? It just seems like there's no end.
    Once you decide that information about who that person has 
communicated with is relevant, is information about who they 
communicated with also relevant, and so on, and so forth? So I 
guess the problem with the relevance standard is that it seems 
to untethered in that when we're talking about an intelligence 
investigation that is, again, not tied to the investigation of 
a particular crime, it seems like there's just no end to the 
information that could be obtained.
    Senator Kyl. I appreciate that point. But it seems to me 
that it, in some respects, ignores realities of life. That is, 
you've got some people who we have a lot of confidence in, 
we've given a great deal of authority to, to protect us from 
terrorism. We have put them into that position and they're in 
real-time situations trying to sort through a lot of material 
to be able to track something to get to the point where they 
can maybe stop a terrorist act from occurring.
    They don't have time in that context, it seems to me, to 
sit around saying, oh, look at this juicy bit of information, 
let's set that aside and maybe we can deal with that later and 
really embarrass this political figure, or why don't we stop 
what we're doing here and gather up all this information for 
some other purpose?
    I mean, they're on the tail of something, they're trying to 
get through it quickly. It seems to me that the problem is 
really quite the other way, and that is to be able to barrel 
through a whole of information as quickly as possible and not 
go back to what they just went through because it's of no 
immediate use to them, and they've simply got too much work to 
do to figure out what the terrorist attack might be to sit 
around and focus on all that.
    So I think that the realities, the practical realities 
don't suggest that the problem is a likely big problem. I 
think, though, that ultimately there's got to be some decision 
made about, OK, now that's over did all of that stuff get 
captured someplace or did we simply go through it and it's 
simply out there in the ether again? To the extent we did make 
a record of some of it, what should be done with it?
    I mean, I can see why privacy concerns there would require 
some mitigation or some procedures and protocols and so on. But 
during the process of trying to prevent the crime or the 
terrorist act itself, it seems to me that the broader standard 
giving them more flexibility and leeway to protect us is the 
appropriate way to approach it. That's my own point of view 
which I believe is pretty consistent with Mr. Woods'.
    Senator Whitehouse. The Senator from Wisconsin?
    Senator Feingold. Thank you, Mr. Chairman.
    Let me briefly respond to what Senator Sessions, and to 
some extent Senator Kyl, said about the standard for getting an 
NSL. Senator Sessions mentioned grand jury subpoenas, which of 
course are to investigate crimes.
    I believe that Congress should change the current relevance 
standard for NSLs. Intelligence investigations are not, as has 
been pointed out, subject to the same built-in checks that are 
present in criminal investigations. They are much broader, 
meaning that virtually anything could be relevant to an 
intelligence investigation. They are conducted entirely in 
secret. Investigative techniques are rarely tested through the 
adversary judicial process. I think that is why more oversight 
is needed, and that is why a more targeted standard is needed 
for the NSL authority.
    So in that connection I would like to ask Mr. Nojeim, we 
have heard a proposal today for a new national security 
subpoena authority. Would you please address your thoughts on 
that proposal?
    Mr. Nojeim. I think that if the response to the Inspector 
General's reports is that there be a broader collection 
device--and that's what these subpoenas would be--that it's 
exactly the wrong response.
    It's not clear to me who could receive one of these 
subpoenas. It does seem to me that they could be received by 
anyone as opposed to just the limited entities that are now 
possible recipients of national security letters.
    There was no discussion about the gag that would come with 
one of these subpoenas. I put those two together because I 
think about who might be a recipient. What we're talking about 
is expanding the class of people who might receive a demand 
from the FBI for information, but, the demand says that they 
can't disclose anything about that demand.
    It could be served on any person. I just don't know how my 
mom would respond to that request. I don't know how other 
people would respond to that request. I don't think that we 
should go in that direction as a result of the abuses that have 
been uncovered in the IG reports.
    Senator Feingold. I couldn't agree with you more. I can't 
imagine how granting the FBI administrative subpoena authority 
is a response to evidence of abuse of their current authority. 
We just barely dodged this bullet in the last round. For this 
to be a response to what we learned about the NSLs strikes me 
as kind of bizarre.
    Mr. Nojeim, two Supreme Court decisions in the 1970s 
determined that Americans do not have Fourth Amendment rights 
to information they reveal to their phone companies or banks, 
such as the phone numbers they dial or the checks they write.
    Given the unprecedented technological advances of the past 
30 years, do you think these decisions would come out the same 
way again today?
    Mr. Nojeim. I think they're on shaky ground today. Take 
Smith v. Maryland, for example. That's the decision where the 
court decided that numbers dialed on a telephone didn't have 
Fourth Amendment protection. They reached that decision in part 
because those numbers dialed are not so revealing. The court 
said, for example, you can't even tell whether the telephone 
call was actually completed. You can't tell who was 
communicated with when those numbers were dialed.
    Fast forward to today and think about the kinds of 
information that qualify as metadata, but that are much more 
revealing. E-mail ``to''/``from'' information. It's usually the 
case that you know who you're communicating with and the 
government will know when it gets that information. It knows 
the communication actually happened. So right there, it's much 
more revealing.
    URL information--where a person went on the Internet. The 
closest parallel to that is probably library sign-out records, 
and most States protect those and require extra procedures. 
Yet, in the internet context, URL information, at least before 
the first backslash, is available with a national security 
letter.
    Senator Feingold. I commend all the witnesses for their 
testimony today. Mr. Nojeim, I particularly commend you for 
your ability today to distinguish not simply between metadata 
and content, but to point out that within the context of 
metadata there really need to be distinctions. It's not simply 
one kind of information or another, there are vast differences. 
You've done an excellent job of pointing out the dangers of not 
having those kind of distinctions within the metadata category.
    Thank you, Mr. Chairman.
    Senator Whitehouse. Thank you.
    I will sort of pick up where I left off, because I find 
this subject so intriguing. I think it's our next really big 
civil liberties issue to address. Does anyone dispute that it 
is essentially inevitable that, given the way we can 
electronically gather and store data, government data bases 
containing personal information are going to continue to 
proliferate and that, given the ease with which access to 
different electronic data bases can be increasingly achieved, 
there will be more and more access points for government 
agencies to those data bases? Are we not, to some degree, 
headed for a situation in which there is essentially a large, 
multi-accessed, multi-inputted, but essentially single 
government data base containing a vast amount of personal data 
related to American citizens?
    Mr. Baker. Senator, there may be a number of reasons you 
wouldn't want to create one data base, but you could have data 
bases that are linked in certain ways.
    Senator Whitehouse. Linkage makes it effectively the same, 
I think.
    Mr. Baker. It would allow you, with certain tools, to go 
through the different data bases. If your query fit the 
criteria for going into a data base, you could come up with 
some kind of a model to do that. So, I think that's right.
    If I could just quickly respond to something that Senator 
Feingold said before he left, since it was my sort of bizarre 
idea to come up with this national security subpoena. Just, I 
want to be clear, and when Senator Kyl was talking about the 
different standards that apply, you can have relevance, you can 
have specific and articulable facts, you can have probable 
cause, but relevance, specific and articulable facts as to 
what? As to what? You have a twofold task in front of you. You 
have to pick the right standard, the right predication, how 
much facts you want to support it, but then as to what? You 
need to think about that.
    My concern is, and the reason I came up with this bizarre 
idea--other people have too--is that if you raise the standard 
with respect to national security letters so high, FBI agents 
in the field will find some other way to get what they need 
because they are charged with, and have tremendous pressure on 
them, to prevent the next attack, as we all know.
    So if national security letters are too difficult, well, 
let's see if we can find something else. 215? Oh, you've got to 
go to a judge. That's a pain in the neck; forget that. Oh. 
Grand jury subpoena? I'll just go to this AUSA that I work with 
all the time, we'll get that, and there's no court oversight in 
the real-time sense and you just get it from the AUSA. There's 
no minimization requirements. Boom, we've got it.
    We've got the information that I believe I, the agent, need 
to protect the country and I'm not going to mess with these 
other statutes. So the volume will drop with respect to 
national security letters, it will be a less effective tool, 
but your insight into what is going on--your, the Congress' 
insight--the government's insight will just change. It will be 
harder to conduct oversight of those kinds of activities, and I 
urge that you worry about that.
    Senator Whitehouse. I understand that. But I think, in 
addition to the question you have raised of the ``how do you 
get it'' problem, we also have to address the ``what do you 
with it'' problem, which I think, as those of us familiar with 
this area--we would generally categorize that as the 
minimization problem. So you've got the ``how do you get it'' 
problem, then once you've got it, what do you do with it, how 
long can you keep it, do you destroy it, who can you connect to 
it, all that sort of stuff.
    Then you have, as you mentioned, the predication problem, 
which is, who is allowed to query it. Who's allowed to hit the 
data base and under what circumstances? Is strikes me that if 
we're going to solve this problem we have to address really all 
of those three issues, that those are the three big prongs of 
this question from the government's point of view: what are you 
allowed to get, what are you allowed to do with it once you get 
it, and who are you allowed to let have a look at it, and on 
what terms?
    Mr. Nojeim. And to add just a couple more things. Not just 
what can you get, but what do you have to show to get it, and 
also what do you do with it after a few years? I mean, do you 
just throw it away or do you save it to see whether it might be 
useful in some other investigation 10 decades from now? I think 
that your--
    Senator Whitehouse. And minimization, I think, has become a 
hugely moving target. In my days as a U.S. Attorney, 
minimization basically meant that the agent flipped off the 
switch on the microphone and stopped listening when it became 
apparent that the conversation was with the subject about pork 
chops for the weekend, that he'd called the butcher. Once you 
learned that this was an every Thursday call for Friday dinner, 
you didn't listen to it at all because you didn't any longer 
have a reasonable basis to listen to it. It was just kind of 
that simple.
    Now, particularly in the FISA minimization context, it's 
gotten much more complex, much more deep in time, and into 
questions of distribution. So the simple ground rules very 
recently have had to adapt to a much more complex landscape, 
and I'm not sure that they're well understood.
    Yes, Mr. Woods?
    Mr. Woods. Senator, there is a reason for that. That is--
and we keep coming back to this matter of intelligence 
investigations--this is fundamentally different than the 
criminal context in that the adversaries we are facing are 
different. We are facing intelligence services with the full 
resources and backing of foreign governments. We are facing 
transnational terrorist groups.
    So FISA minimization, for example, is structured after the 
fact, I think largely because of the language difficulties. You 
may be intercepting something on FISA that's in a dialect of, 
choose the language, and therefore the Congress allowed that to 
be done after the fact. I think we face the same thing here. To 
go to your earlier comments, it is important to remember that 
these intelligence investigations are not solely restrained by 
these statutes. We have 30 years of oversight, of regulation, 
of Attorney General guidelines, of executive orders.
    The reason I put so much emphasis on retention/minimization 
issues is, over the years that has been the least-glamorous 
part of this work. I would say that minimization rules are 
stuck in the Xerox era, at best. What we need--I mean, 
minimization in the FBI, in my experience, was done with 
respect to FISA quite carefully, and one of the reasons is that 
every so often the Justice Department comes by and audits it. 
There's nothing like that. We've had national security letters 
since 1986. This is the first serious audit of how they are 
being used. I think, going forward, the Committee really ought 
to look at creating some of that, and at the same time maybe 
look at updating stuff from the Xerox era to something a little 
closer now.
    Senator Whitehouse. I also felt that the minimization 
process in Federal investigations that I oversaw, and at State 
investigations--I was a State Attorney General as well--was 
helped by the prospect that the Rhode Island State Police, 
local FBI agents, Secret Service agents, or ATF agents had that 
they were operating pursuant to an order allowing them to do 
this, which incorporated in its terms the legal requirement 
that they follow the minimization procedures, and that there 
was the prospect that a judge might at some point take an 
interest and say, you know, I signed this order and gave you 
the authority to collect this stuff, I told you you had to do 
it under these terms, I want to have a look. And just the 
prospect, I think, of judicial oversight was very helpful.
    It's one of the reasons we've had this fight on the Foreign 
Intelligence Surveillance Act, because they put out 
minimization rules but they wouldn't let it be set up so that 
the FISA court ever had the authority to see if they were being 
complied with, which completely undercut that motivation. I 
thought that was mistake, and thankfully I think we've 
corrected that in the FISA statute.
    Mr. Nojeim. I think that one of the reasons that we need 
the NSL Reform Act is that it requires that minimization 
procedures be adopted. There was a provision in the 
reauthorization legislation that required the Attorney General 
and the DNI to study whether minimization would be feasible. An 
NSL working group involving both agencies was put together. 
They recommended basically the FISA minimization procedures, 
but the Attorney General rejected that. I think it's time for 
you to say, we're going to have to step in and require that 
these minimization procedures be adopted.
    Senator Whitehouse. A lot of very sensible stuff seems to 
have been rejected for reasons that make absolutely no sense to 
me.
    Senator Kyl?
    Senator Kyl. Well, let me just play off that point. There's 
a hierarchy of values here. One, is the protection of the 
American people from known dangerous enemies who have struck us 
with great destruction. We have instructed others in our 
government to see that that never happens again. Every one of 
us ought to be strongly committed to that.
    Now, we also have the potential prospect of violations of 
privacy that might have an adverse consequence on someone, but 
I don't think there's a lot of evidence that that's happened 
yet.
    I recall the words of the FBI agent who, about two and a 
half weeks before 9/11, complained to another that, because of 
the wall that separated two groups within the FBI, the 
Terrorist and Criminal Investigation, that someday somebody was 
going to get killed and then questions would be asked, and of 
course that's what happened.
    So on the one hand, we have something that is critical for 
the protection of the American people, and we've seen 
breakdowns in that because we set up artificial legal barriers 
to the exchange of information and collection of information. 
On the other hand, we're all concerned about privacy because we 
can see in the future, if not today, a ballooning of 
information and access to information, and we're rightly 
concerned about how that's all used.
    But I suggest we keep this in perspective, and that 
enabling the people to do the job to protect this starts with, 
I would argue, a lower standard like the relevancy kind of 
standard. Then in order to prevent that other potential from 
occurring, you can build on it. All of you have addressed that 
in one way or another, and I think we're all in agreement that 
both of those require work.
    But just another specific example that we fixed, Zacharias 
Mousawi. He didn't fit into the two ways that you could get 
information. We couldn't prove that he was an agent of a 
foreign power or that he belonged to a terrorist organization. 
They don't carry cards anymore. He was acting on his own in 
concert, ultimately, with another group. So we had to create a 
third category after the fact, unfortunately.
    What it demonstrates is, I think we need to be a little bit 
more liberal on the front end for the purposes of the 
protection of the American people, and then make sure that, 
whether it's minimization procedures or other kinds of 
protocols that ensure the privacy of the American people, to 
put those into place. But looking at the relative challenges 
and relative threats and relative harms that have occurred so 
far, it seems that some may be balancing these equities, I 
think, in the wrong way.
    I would hope that as we draw on your expertise--all three 
of you have been very valuable to this exercise today. As we 
continue to draw on your expertise, would you also take into 
account what I am trying to say here? Because as policymakers, 
we've got to take all of these things into consideration. It 
seems to me that--well, I've made my point. If any of you would 
like to comment, I still have a little bit of green left.
    Mr. Baker?
    Mr. Baker. Yes, Senator. With respect to the law, I mean, 
Michael and I both lived through the era of the wall and we can 
probably go on for quite a bit of time about that.
    But let me just say, that's why I focused on creating--
urging you to create--a system that's simple and effective. One 
of the lessons from the wall was, the rules were complex, the 
rules were misunderstood, and people were afraid of the adverse 
consequences to their career of making a mistake, so they 
didn't do what they should have done in certain instances with 
respect to sharing information.
    I think that's one of the things you don't want to have 
happen here. I think with respect to the current regime that we 
have, as reflected in the IG's report, you do have confusion 
about what these statutes allow: you do have confusion with 
respect to what the scope is, you have confusion about what the 
standard is.
    So, I think that has contributed to the situation that we 
find ourselves in today. The only other comment I would make 
is, the IG's report with respect to national security letters 
are bad facts. I mean, that is a very bad situation. All I 
would suggest to the Congress, as we all learned in law school, 
bad cases make bad law. My urging is, don't let that happen.
    Senator Kyl. But fix the bad cases.
    Mr. Baker. Fix the bad cases, but make sure you don't 
inadvertently create some other problem.
    Mr. Nojeim. I think if we can learn one thing from the IG 
reports, it's that people who mean well and are in the business 
of collecting this information didn't do a good job about 
following the rules. I think there's just no question about 
that when you look at the Inspector General reports.
    I think there's also no question that some of the reforms 
that the FBI put in place are going to address some of those 
problems, but the bigger problems can't be addressed by 
changing the people who do the work or by changing what work 
they do. There just has to be a judicial check at some point in 
this process when the information is particularly sensitive. 
Again, the principle that we're asking you to abide by is that 
the more sensitive information ought to be under that judicial 
check, and that less sensitive identifying information could 
still be sought without it.
    Senator Kyl. A final word, Mr. Woods?
    Mr. Woods. All right.
    Senator Kyl. Again, thank you to all three of you. I 
appreciate it.
    Mr. Woods. I actually agree with what both of the other 
witnesses have been saying, in principle. I think the committee 
should be guided by a rule of proportion. I mean, I read the IG 
reports and I see errors and ineptitude in the nuts and bolts 
of this, the kind of right documentation here, what should be 
uploaded, what shouldn't be uploaded. I do not see, as one 
sometimes hears in the discussions, a malevolent presence in 
the government that is bent on subverting people's civil 
liberties or obtaining information that it should not obtain.
    I think the remedy ought to reflect the reality of what's 
in those reports, which to me means concentrating a lot of 
effort on that nuts-and-bolts level and not ratcheting up the 
legal standard that affects every case, or attempting to sort 
of, you know, throw up our hands and say, this is scary and 
we're going to try to back off, because that affects the 90 
percent of the cases that didn't even have these nuts-and-bolts 
problems in the IG report. That's what I've been trying to 
argue, and I'm happy to assist the Committee, as I'm sure my 
colleagues are.
    Senator Whitehouse. Well, I agree with you that there are 
two very different issues here. One is the very simple, old-
fashioned bureaucratic foul-up that took place at the FBI with 
respect to the implementation process for these NSLs, and that 
is an important problem. It's a problem that we have drilled 
into, that the Inspector General has drilled into that I think 
a variety of initiatives will help to minimize. But every time 
we touch on this issue I think it raises these larger questions 
of, really, what the rules are. I don't think we've adapted 
well enough yet to this modern electronic world in which there 
are vast pools of information available.
    I do think that the privacy of American citizens is a core 
value in our society and it's a core value for a reason because 
it affects the balance of power, if you will, between 
government and citizenry. In a democracy, that is absolutely 
vital. So I give it, perhaps, a higher value than some of my 
colleagues do.
    But wherever you assign its value, I think I agree with the 
Senator from Arizona's point, that the American people could 
feel more comfortable about what information is made available 
to law enforcement if they had a higher level of comfort with 
what would happen to it once law enforcement had its hands on 
it in terms of its duration, maintenance, and all of that, and 
with what uses it would be put to and who would have access to 
it.
    So I see the question as how you define what the government 
can get access to, how you define what the government can do 
with it once it's been allowed to get access to it, and how you 
define who's allowed to query that pool of information which, 
in a nutshell, are access, minimization, and predication, as 
related phenomena that I think this Committee and this Congress 
are going to have to deal with. I think I will ask you for 
final comments, because we're nearly done with our time. Your 
thoughts on how you see those are three related, cross-
referencing, interwoven concepts.
    Mr. Baker?
    Mr. Baker. Well, I think you're exactly right, Senator. If 
you look at old FISA that we've been talking about, the 
original FISA, that required minimization of acquisition in 
terms of, what does the government get and why; minimization of 
retention: once you've gotten it, what do you keep? Do you 
throw certain things away? Who has access to it? What do they 
do with it? Where do they store it? How can they look at it? 
And then minimization of dissemination: Who can they give it 
to, what purpose can they use it for, and so on.
    If you look at the definition of minimization under FISA, I 
think it's a pretty good one because it says that the Attorney 
General will approve minimization procedures that will be 
reviewed by the court and approved by the court, but that--on 
the one hand, do all that, limit the acquisition, retention, 
and dissemination of non-relevant, non-pertinent U.S. person 
information, consistent with the need of the United States to 
obtain, produce, and disseminate foreign intelligence 
information.
    So you've got to have the right balance, exactly what 
you're saying. You've got to have the right access to the right 
data, at the right time, for the right purposes, and to be able 
to use it effectively for what we all want to accomplish. So I 
think that is what you are focused on. I think that's exactly 
right.
    I would just add in, as we discussed earlier, you need to 
think about how long we're going to keep this stuff. As these 
data bases grow at a certain point in time, what should we be 
throwing away? Stuff that has not been found to be relevant or 
pertinent to an investigation in the sense that it's produced a 
lead that's really, really good during a 5-year period, should 
we throw it away at that point in time, or what are we going to 
do with it?
    Senator Whitehouse. Mr. Nojeim?
    Mr. Nojeim. It seems to me your ability to control some of 
the things that you want to control is limited, but is 
available for some of the things you want to deal with. So, for 
example, on ``what is the quality of the employees that are 
doing this work, accessing this information? '' I don't think 
you're going to have a lot of control over that.
    You'll be able to approve the people at the top, but the 
people below them you're not going to be able to control that 
much. ``Who in government can get the information once it's 
uploaded into one of the databases? '' I don't think you're 
going to want to put a lot of limits on that because of the 
imperative toward information sharing. So you might, but 
probably won't put limits on that. I think that we're really 
looking at the front end and the back end.
    Senator Whitehouse. Well, the logical limit on that, just 
to interject, would be not who gets access to it so much as 
when they get access, the predication question.
    Mr. Nojeim. For what purpose. For what purpose they get 
access.
    Senator Whitehouse. At what point does somebody in the 
government say, I'm interested in Mr. Nojeim's file, let me 
pull that up? It shouldn't be just on every government 
computer. There should be a question that has to be answered 
first: I need this because X. Particularly in the public 
corruption world, you've got to predicate before you can go 
after a public official. I think there's a similar test. It's 
not just who has access, it's what is required. What's the 
question that they have, and is it a legitimate question?
    Mr. Nojeim. I think that's exactly right. I think it's very 
hard to legislate because there are just so many contexts in 
which you're going to have to think down the road. I think that 
it's worth talking about.
    I also think, though, where you can be most effective is at 
the front end and the back end. It's articulating a standard 
that is what permits the data to get into the data base in the 
first place, and articulating the minimization procedures that 
must be followed for getting it cleared out at the end of the 
day.
    Senator Whitehouse. Yes. I appreciate it. Thank you.
    Mr. Woods, it looks like you have the final word.
    Mr. Woods. I think that we shouldn't simply take a step 
because it's easy. It's easy to look at the front end and say 
we need to change the standard. I really do believe that the 
core of this is in the sort of middle and back end of this, 
controlling what is done with information. But I would just end 
on your point about--
    Senator Whitehouse. In terms of the interrelationship, do 
you agree that if we're going to really get this right we're 
going to have to focus on not only acquisition, but also 
minimization and retention and also predication and the 
querying function, and that those three need to be seen as a 
coordinated group?
    Mr. Woods. They are all linked. I think--and you're seeing 
this--as soon as you enter into this question you get pulled 
into the much broader issue of information sharing, of access 
to digital information. I think a very important issue, and 
that is public confidence. Things like the IG report shake 
public confidence and make the public concerned about these 
issues. I don't think the public understands how their 
information is handled, either by the government or by 
commercial entities. It is a very large question and I think I 
would just urge the Committee to stick with it. It's not going 
to be easily resolved, but it desperately needs doing.
    Senator Whitehouse. Good.
    Well, I want to thank all the witnesses. I think this has 
been a helpful and interesting day. I would urge you also to 
stick with it and keep doing your work, and keep hammering on 
Members of Congress to get to this. We are, I think, in a very 
interesting time, driven by the technological leaps that we've 
taken. I will close by repeating the observation I made at the 
beginning when the Founding Fathers were designing the Fourth 
Amendment. It never crossed their mind that the sheriff would 
keep any evidence. It would be thrown out. It would be used at 
trial and it would be returned, or be destroyed if it was 
contraband. That was it.
    Now we have this facility for maintaining huge amounts of 
information and it raises a question that, because the Founding 
Fathers did not face, we can't go and grab an answer off the 
shelf. This generation has to figure it out based on the 
principles that have made this country great. I think it's a 
fascinating topic, and I appreciate your attention to it
    The record will remain open for 7 days for any additional 
submissions anybody chooses to make.
    The hearing is hereby adjourned.
    [Whereupon, at 11:54 a.m. the Committee was adjourned.]
    [Questions and answers and submissions for the record 
follow.]
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